Commit Graph

5739 Commits (052)

Author SHA1 Message Date
Jan Macku 70b19acf94 Replace ln with systemctl 2020-01-14 09:29:51 +01:00
Jacob Wen d5e818f349 35network-legacy: using 'replace' instead of 'add' to add route
This is a simple trick to honor RFC 3442:
If the DHCP server returns both a Classless Static Routes option and
a Router option, the DHCP client MUST ignore the Router option.

Signed-off-by: Jacob Wen <jian.w.wen@oracle.com>
2020-01-14 09:26:12 +01:00
Kairui Song 4598b5540e 95iscsi: Fix /etc/iscsi installation
Previous all files are installed with inst_dir, which will not install
the files under /etc/iscsi/, and it create folders with the same of the
files which is wrong.

Now only use inst_dir to install the config dir and ensure it
exists, and use inst_multiple to install the config files.

Signed-off-by: Kairui Song <kasong@redhat.com>
2020-01-14 09:25:29 +01:00
Lubomir Rintel 5965710e01 network-manager: don't run NetworkManager when there are no connections
NetworkManager would unnecessarily bring up the devices, colliding with
further attempts to rename the devices.

This is arguably a NetworkManager bug and should eventually be fixed there.
Running NetworkManager without the connection is unnecessary regardless.
2020-01-14 09:24:42 +01:00
Brian C. Lane 05b75703b0 Check .hmac of boot.iso in fips mode
Instead of carrying the kernel and hmac in the install.img (which takes
up more space) use the vmlinuz installed under /images/pxeboot/ and the
.hmac in the install.img /boot.

This check is triggered by the presence of /run/install/repo/images/pxeboot/vmlinuz

Related: rhbz#1782737
2020-01-14 09:23:21 +01:00
Colin Walters 7fea85ce5f modules/network-manager: Install `ip`
We don't need `ip` but having it is *really* useful for people debugging
in an emergency shell.
2020-01-14 09:17:22 +01:00
Lukas Nykryn 2181c80c91 network-legacy/ifup: dhclient should be started in oneshot mode
since we handle the retries explicitly via rd.net.dhcp.retry

Without -1 if user sets ip=dhcp6 and there is no dhcp on the network,
dhclient seems to wait indefinitely, ignoring rd.net.timeout.dhcp
2020-01-14 09:16:48 +01:00
Lukas Nykryn 212043f94d network-legacy/ifup: fix typo when calling dhclient --timeout 2020-01-14 09:16:23 +01:00
Alexey Kodanev 958ca9e912 fips: add 'ofb' and 'cts' block cipher modes
Add cts, Linux-5.0 commit:
* 196ad6043e9f ("crypto: testmgr - mark cts(cbc(aes)) as FIPS allowed")

Linux 4.20 commits for 'ofb':
* dfb89ab3f0a7 ("crypto: tcrypt - add OFB functional tests")
* e497c51896b3 ("crypto: ofb - add output feedback mode")

Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
2019-11-29 18:56:56 +01:00
Petr Tesarik 7d47d1c423 95ssh-client: improve nsswitch.conf parser
The actual syntax of nsswitch.conf is slightly different from the
current regular expression:

- A comment can appear anywhere, not just at the beginning of a
  line.
- Action items take the general form [STATUS=ACTION] or
  [!STATUS=ACTION] (with some optional whitespace).
- A service name cannot include a colon. This is a nitpick,
  because there should never be more than a single colon per
  line.

Signed-off-by: Petr Tesarik <ptesarik@suse.com>
2019-11-22 17:54:00 +01:00
Lubomir Rintel ff2043fb42 Revert "travis: run TEST-14-IMSM on Fedora 29"
We're on Fedora 31 that should be good enough for this test.

This reverts commit 7a2503ab8c.
2019-11-13 10:08:32 +01:00
Daniel Molkentin 8996d3dfcd test: use hosts randomness, not rngd 2019-11-13 09:07:45 +01:00
Daniel Molkentin c226bfdda7 test: Provide host's randomness via virtio 2019-11-13 09:07:45 +01:00
Lubomir Rintel 9a752007b3 TEST-30-ISCSI: test iBFT boot as well
Setting up the machinery to boot with the aid of real networked boot loader
(such as iPXE) would involve much hassle, including possibly serving the kernel
and initrd via TFTP, etc.

Let us generate the iBFT table ourselves, with a Perl script. Include the
pregenerated table as well so that the test run won't depend on Perl. In the
end it's just reproducibly built static data, totally independent of the host
system.
2019-11-12 13:27:59 +01:00
Lubomir Rintel 80238086ab git2spec: include contents of binaries in patches
The patches don't include the binary files, such as the iBFT table for testing,
which makes %autosetup sad.
2019-11-12 13:27:59 +01:00
Daniel Molkentin 50057af19c Documentation: dynamically set current version
Fixes #369
2019-11-12 13:24:41 +01:00
Lubomir Rintel e863807685 spec: dracut-network is happy with either NM or dhclient 2019-11-12 13:11:40 +01:00
Lubomir Rintel f3f081e542 TEST-{20,50,60,70): set MACAddressPolicy=keep
New systemd defaults to generating MAC addresses for software devices (whereas
previously they would inherit them from the first enslaved slave).

Sadly, among the things this breaks is our test fixture, where the dhcp servers
are configured to expect a particular MAC address. Disable this for the
affected tests, which are essentially the ones that use bridges and bonds.
2019-11-11 21:17:31 +01:00
Lubomir Rintel c9391e8f6a TEST-{20,30,31,40,50,60,70): wait for server interfaces to come up
The network interfaces appear asynchronously and sometimes just too late,
after we're already halfway throught server-init.sh:

  + ip link set dev eth0 name ens3
  Cannot find device "eth0"
  + ip addr add 192.168.50.1/24 dev ens3
  Cannot find device "ens3"
  + dhcpd -cf /etc/dhcpd.conf -lf /var/lib/dhcpd/dhcpd.leases ens3 ens5
  ...
  [    8.040825] e1000 0000:00:03.0 eth0: (PCI:33MHz:32-bit) 52:54:01:12:34:56
  [    8.047105] e1000 0000:00:03.0 eth0: Intel(R) PRO/1000 Network Connection
  ...
  No subnet declaration for ens3 (no IPv4 addresses).
  ** Ignoring requests on ens3.  If this is not what
     you want, please write a subnet declaration
     in your dhcpd.conf file for the network segment
     to which interface ens3 is attached. **

Whoopsie. Let's ensure all the interfaces are there before we proceed
fiddling around with them.
2019-11-11 21:16:47 +01:00
Lubomir Rintel 031e949c62 TEST-50-MULTINIC: fix how a basename is determined
Analogous to what commit 687e17aa7f ("network-manager: fix getting of
ifname from the sysfs path") fixes.
2019-11-11 21:15:52 +01:00
Lubomir Rintel 10f8438c1e logtee: time out after a period of no output
Travis cuts us short after 10 minutes of slience, giving us no chance to puke
out the output. Be faster.
2019-11-11 20:30:45 +01:00
Lubomir Rintel f5d48a31db Revert "travis: run TEST-13-ENC-RAID-LVM on Fedora 29"
We're on Fedora 31 that should be good enough for this test.

This reverts commit 8238f41b34.
2019-11-11 20:04:58 +01:00
Lubomir Rintel fe54c9b7a9 TEST-13-ENC-RAID-LVM: increase memory
In Fedora 31 it ooms until it has, uh, twice the memory.
2019-11-11 20:04:58 +01:00
Doan Tran Cong Danh 41a37bc626 dmraid: require kpartx binary
dmraid requires kpartx to activate device mapper.
But kpartx is only a recommend dependency.

Check for kpartx's existent first.

Signed-off-by: Doan Tran Cong Danh <congdanhqx@gmail.com>
2019-11-10 01:47:30 +01:00
Doan Tran Cong Danh cf31ed2ae6 multipath: require kpartx binary
multipath requires kpartx to activate device mapper.
But kpartx is only a recommend dependency.

Check for kpartx's existent first.

Signed-off-by: Doan Tran Cong Danh <congdanhqx@gmail.com>
2019-11-10 01:47:30 +01:00
Doan Tran Cong Danh 62f27ee6f1 configure: find cflags and libs for fts on musl
Signed-off-by: Doan Tran Cong Danh <congdanhqx@gmail.com>
2019-11-10 01:47:30 +01:00
Mikhail Novosyolov 718aefda13 Ensure that udevadm --version reported an integer
If it is not an integer, further script will fail unexepectedly.
2019-11-05 14:26:14 +01:00
Mikhail Novosyolov 6e761674ad Fail if udevadm could not be run
Fixes: #668
2019-11-05 14:26:14 +01:00
Lubomir Rintel 687e17aa7f network-manager: fix getting of ifname from the sysfs path
commit 5e0f8c8a4c ('network-manager: remove useless use of basename')
somewhat carelessly didn't take into account that $_i has a slash at
the end which made the result of the ## substitution be just an empty
string.

The slash was put to the end of /sys/class/net/*/ to make sure we're only
iterating directories, but it's not strictly necessary. In an unlikely case
something else than a directory appears in /sys/class/net/, we'll already deal
with it gracefully. Remove it.

This fixes the TEST-30-ISCSI test.
2019-11-05 14:18:01 +01:00
Thomas Blume 3f4bbca751 keep network device naming scheme on upgrade 2019-11-05 11:37:22 +01:00
Jonathan Lebon cc6792a01e 01fips: trim off GRUB boot device from BOOT_IMAGE
E.g. in RHCOS, the `BOOT_IMAGE` from the cmdline is:

(hd0,gpt1)/ostree/rhcos-e493371e5ee8407889029ec979955a2b86fd7e3cae5a0591b9db1cd248d966e8/vmlinuz-4.18.0-146.el8.x86_64

Which of course is a GRUB thing, not an actual pathname we'll be able to
resolve. In fact, we can simply scrap it off from the variable. Our code
is already able to handle both cases: whether the device refers to a
separate boot partition, or just the root filesystem with a regular
`/boot` directory.
2019-10-31 11:12:36 +01:00
Jonathan Lebon ca4aa84851 01fips: add / in BOOT_IMAGE_HMAC filename for clarity
It's already the case the `BOOT_IMAGE_PATH` today, in the non-empty
case, includes a trailing `/`, but let's add it to the path we build
here too to make it more obvious.
2019-10-31 11:12:36 +01:00
Jonathan Lebon ba813779bf 01fips: run sha512hmac from directory HMAC file directory
That way, the HMAC file can contain a relative path instead of an
absolute one. The issue is that right now the kernel RPM bakes the
`/boot/vmlinuz-${kver}` path into the HMAC file which poses an issue for
rpm-ostree systems (and any other system where the kernel isn't simply
in the top-level `/boot`.

For now, we're hacking around this in rpm-ostree:
https://github.com/coreos/rpm-ostree/pull/1934

Though I'd like to propose the same change in the kernel spec file.
2019-10-31 11:12:36 +01:00
Jonathan Lebon 9e759aa969 01fips: fix HMAC file path resolution
There is a small regression in #343: when handling the 'separate boot
partition' case, we're checking for the kernel image in the wrong
location: `BOOT_IMAGE` is the `/boot`-relative path to the kernel image,
so `/boot/${BOOT_IMAGE_PATH}/${BOOT_IMAGE}` expands to e.g.
`/boot/mysubdir1/mysubdir2/mysubdir1/mysubdir2/vmlinuz...`.

We should be using `BOOT_IMAGE_NAME` here instead (and in fact, the next
if-statement does this correctly, so it might've just been accidentally
left out of #343).
2019-10-31 11:12:36 +01:00
Harald Hoyer 27f758e12c
iscsi: remove bashisms 2019-10-25 14:29:17 +02:00
Böszörményi Zoltán 4efcd19a4e Add documentation and Yocto examples
Signed-off-by: Böszörményi Zoltán <zboszor@pr.hu>
2019-10-25 11:58:58 +02:00
Böszörményi Zoltán 0595a79b19 Fix version reported by dracut --help
Signed-off-by: Böszörményi Zoltán <zboszor@pr.hu>
2019-10-25 11:58:58 +02:00
Böszörményi Zoltán 9d88e89350 Set systemdutildir correctly
Signed-off-by: Böszörményi Zoltán <zboszor@pr.hu>
2019-10-25 11:58:58 +02:00
Böszörményi Zoltán b552d364a3 Handle -r / --sysroot option in dracut.sh
It was documented but not implemented.

Signed-off-by: Böszörményi Zoltán <zboszor@pr.hu>
2019-10-25 11:58:58 +02:00
Böszörményi Zoltán a01204202b Allow running on a cross-compiled rootfs
For the shell scripts, new environment variables were introduced.

dracutsysrootdir is the root directory, file existence checks use it.

DRACUT_LDCONFIG can override ldconfig with a different one that works
on the sysroot with foreign binaries.

DRACUT_LDD can override ldd with a different one that works
with foreign binaries.

DRACUT_TESTBIN can override /bin/sh. A cross-compiled sysroot
may use symlinks that are valid only when running on the target
so a real file must be provided that exist in the sysroot.

DRACUT_INSTALL now supports debugging dracut-install in itself
when run by dracut but without debugging the dracut scripts.
E.g. DRACUT_INSTALL="valgrind dracut-install or
DRACUT_INSTALL="dracut-install --debug".

DRACUT_COMPRESS_BZIP2, DRACUT_COMPRESS_LBZIP2, DRACUT_COMPRESS_LZMA,
DRACUT_COMPRESS_XZ, DRACUT_COMPRESS_GZIP, DRACUT_COMPRESS_PIGZ,
DRACUT_COMPRESS_LZOP, DRACUT_COMPRESS_ZSTD, DRACUT_COMPRESS_LZ4,
DRACUT_COMPRESS_CAT: All of the compression utilities may be
overridden, to support the native binaries in non-standard places.

DRACUT_ARCH overrides "uname -m".

SYSTEMD_VERSION overrides "systemd --version".

The dracut-install utility was overhauled to support sysroot via
a new option -r and fixes for clang-analyze. It supports
cross-compiler-ldd from
https://gist.github.com/jerome-pouiller/c403786c1394f53f44a3b61214489e6f

DRACUT_INSTALL_PATH was introduced so dracut-install can work with
a different PATH. In a cross-compiled environment (e.g. Yocto), PATH
points to natively built binaries that are not in the host's /bin,
/usr/bin, etc. dracut-install still needs plain /bin and /usr/bin
that are relative to the cross-compiled sysroot.

The hashmap pool allocate_tile/deallocate_tile code was removed
because clang-analyze showed errors in it. hashmap_copy was removed
because it wasn't used and clang-analyze showed errors in it.

DRACUT_INSTALL_LOG_TARGET and DRACUT_INSTALL_LOG_LEVEL were
introduced so dracut-install can use different settings from
DRACUT_LOG_TARGET and DRACUT_LOG_LEVEL.

Signed-off-by: Böszörményi Zoltán <zboszor@pr.hu>
2019-10-25 11:58:58 +02:00
Kairui Song 89bc1aa324 Fine tune mksquashfs options for squash module
Drop some unneeded metadata in the squash image, and print the error
message if something went wrong.

Signed-off-by: Kairui Song <kasong@redhat.com>
2019-10-25 11:52:05 +02:00
Jiri Konecny 0d609ae274 Support only fips=1 not fips
It looks like only the 'fips=1' is really supported and it is working
correctly. So instead of failing on 'fips' not clear way give user
information why we are failing.
2019-10-25 11:47:04 +02:00
Jiri Konecny 7ff0fcb723 Fix boot with `fips` without a value
If you boot system with `fips` and not `fips=1` then you will get unary
operator expected error. This will fix this problem.
2019-10-25 11:47:04 +02:00
Daniel Molkentin feebf17187 ucode: properly include early only ucode
Intel has notified us that some microcode updates are not safe
to be applied during runtime. To accomodate for that, microcode
files shipped by SUSE and openSUSE have an '.early' postfix such
that triggering

/sys/devices/system/cpu/microcode/reload

from a booted system cannot pick up the ucode by accident, while
still allowing the code to be picked up during initrd time.

This change is needed to make this scheme work also in a hostonly
situation.

Currently, this affects only 06-4f-01, which is now 06-4f-01.early.

If a distro does not change the filename, the behavior does not
change.

Reference: osc#1098915
2019-10-25 11:39:16 +02:00
Daniel Molkentin e3edd247ce 95iscsi: handle qedi like bnx2i
The new qedi driver needs to be handled just like
the bnx2i driver, so update 95iscsi scripts to do this.

References: bsc#1113712

Signed-off-by: Lee Duncan <lduncan@suse.com>
2019-10-25 11:38:17 +02:00
Nathan Rini 916ac45cbe swap for loop to POSIX shell compat 2019-10-25 11:37:43 +02:00
Nathan Rini 0bac59ee5e typo bugfix 2019-10-25 11:37:43 +02:00
Nathan Rini fb3d292800 fix off by one 2019-10-25 11:37:43 +02:00
Nathan Rini 1b38fa412c bugfix for initialization
exit with error if all retries fail
2019-10-25 11:37:43 +02:00
Nathan Rini 66bfa66add add sleep and max number of retries 2019-10-25 11:37:43 +02:00